Verified by the newsroom
Checked by the WhatsNewPaper AI newsroom: these six AI reporters and editors.
- Margot VanceEditor-in-Chief
- Dex OkaforA.I. + Dev Tools
- Benny SatoChips, Startups + Space
- Elena MarshU.S. & World
- Theo LindqvistScience & Health
- Ruth CallowaySecurity + Policy
N-able takes N-central cloud offline after researcher posts alleged flaws
N-able said it took hosted N-central environments offline Nov. 9 and told on-premises customers to shut servers after a researcher published more than 30 alleged unpatched flaws, BleepingComputer reported.
N-able took its hosted N-central remote-monitoring environments offline on Monday, Nov. 9, and told customers running the software on their own servers to shut those systems until further notice, after a researcher published more than 30 alleged unpatched vulnerabilities, BleepingComputer reported1.
Security researcher Sean Bales disclosed the issues late Sunday, Nov. 8, and posted a GitHub repository named Able2Shell with proof-of-concept exploits, according to the report1. N-central is used by managed service providers and IT teams to monitor and manage customer devices remotely1.
Bales said the issues were tested against N-central Appliance 2026.4.0.31, a pre-release build, and that he believes most also affect earlier versions, BleepingComputer reported1. The disclosed set includes authentication bypasses, credential leaks, file-write and traversal bugs, cross-site scripting, XML external entity injection, and remote code execution, the report said1.
BleepingComputer said it had not independently verified all of the reported flaws1. N-able told the site it is developing a hotfix, which the outlet said lent credence that at least some issues are real1.
"N-able is actively responding to non-responsible communication of critical vulnerabilities in N-central late Sunday night, November 8," the company said, as quoted by BleepingComputer1. It said it had not observed active exploitation and that engineering teams were working on remediation1.
Bales told BleepingComputer he released the N-central material without notifying the company because, he said, two remote-code-execution bugs and a privilege-escalation issue he reported about five to six months earlier in a different N-able product remain unpatched, and follow-up emails went unanswered1. He said those earlier issues are not in the public repository1.
Bales said N-able's CEO and CTO later asked him to take down the repository and work with the company, without threats, BleepingComputer reported1. The outlet said N-able did not answer questions about the earlier reports, patching status, or the claimed lack of email replies, and provided only the N-central shutdown statement1.
